CS1705

mobile management
responsiveness, but can also be a major
security headache without strict
management. The network's attack
surface is increased with each new
mobile device, and many organisations
quickly lose track of what devices are
connected and how they are being used".
The BYOD approach, in particular, can
expose companies to a much greater level
of risk, as a mobile that is also used as
personal device will be more likely to be
hit by threats such as mobile malware
and fake or corrupted apps.
A compromised device can then be used
to infect the rest of the corporate
network or access confidential emails and
other data. "Any company with a mobilecentric
workforce should ensure it has a
strict Mobile Device Management (MDM)
strategy to secure emails and corporate
documents, segregate corporate data,
and enforce security policies," states
Noctor. "However, MDM is not always
applicable and can be difficult to
combine with BYOD or apply to
individuals such as contractors and others
who have access to corporate resources,
but are not full employees."
Mobile Application Management (MAM)
is a more flexible and secure approach for
this more diverse workforce, he suggests.
"This approach places security and app
management policies around the
individual business applications, so they
are protected without the need to enrol
the device in MDM. Workers are provided
access to officially sanctioned and
secured mobile apps via a private
enterprise app store. This ensures that
employees are able to easily access the
best apps for the job, while also enabling
the organisation to keep track of what
applications are being used." Managing
mobile apps in this way can also help
enterprises ensure the highest levels of
security even without requiring MDM.
"Powerful app-level policies can be used
to enforce security policies, such as
detecting jailbroken devices and applying
run-time integrity checks, as well as
ensuring that all apps are kept updated,"
he adds.
INADEQUATE PROTECTION
Despite the publicity around mobile
security, research seems to suggest that
many organisations are not adequately
protecting workers and devices when on
the move or in public spaces, comments
Dave Williams, business manager - UK
Electronics Market, 3M. "As well as more
robust software-based measures, another
factor to consider is the 'low tech' one of
prying eyes. Just looking over someone's
shoulder, he cautions, is "one way to
obtain confidential information. Security
breaches are not confined to savyy
hackers".
In the recent Public Spaces Survey
commissioned by 3M and conducted by
the Ponemon Institute, nine out of 10
people questioned had noticed someone
looking at data on their laptops in public,
according to Williams. "Seventy-six per
cent had also inadvertently seen
something on someone's screen that they
should not have done. However, just over
50% confirmed they had not taken any
preventive steps to protect their own
screens from onlookers in public."
VISUAL HACKING
Other research also demonstrates just
how easy it is to carry out a 'visual hack',
whether inside or outside the office," he
continues. "In the Global Visual Hacking
Experiment, also carried out by the
Ponemon Institute on behalf of 3M,
involving a 'white hat' hacker, more than
90% of visual hacking attempts were
successful, with 49% of breaches taking
less than 15 minutes, with an average of
3.9 pieces of sensitive data obtained per
attempt.
"The reality is that, while visual hacking
is fast and easy to achieve, it is also fast
and easy to prevent, using techniques
such as installation of privacy filters,
which stop on-screen information from
being viewed, unless straight-on and
close-up; angling screens, so they cannot
easily be seen; plus educating employees
about their responsibility to prevent
sensitive data being visible to others,
particularly when they are working in
public spaces."
28
computing security May/June 2017 @CSMagAndAwards www.computingsecurity.co.uk